from lib.cuckoo.common.abstracts import Signature


class AttemptLoadSuspiciousDll(Signature):
    name = "attempt_load_suspicious_dll"
    description = "Attempt to load suspicious dll."
    severity = 3
    categories = ["commands", ]
    authors = ["xuhy"]
    minimum = "2.0"

    dlls_re = [
        ".*\\\\.*.(dll|DLL)",
    ]

    files_re = [
        ".*\\\\.*.(dll|DLL)",
    ]

    file_actions = [
        "file_opened", "file_exists", "file_read",
    ]
    regkeys_re = [
        ".*\\\\(SOFTWARE|Software)\\\\(Wow6432Node\\\\|WOW6432Node\\\\)?Microsoft\\\\Windows\\\\Windows Error Reporting\\\\WMR\\\\Disable",
    ]

    def on_complete(self):
        for indicator in self.regkeys_re:
            for regkey in self.check_key(pattern=indicator, regex=True, all=True):
                self.mark_ioc("registry", regkey)
                self.severity += 1
        for cmdline in self.get_command_lines():
            if "rundll32" in cmdline.lower() and "dllmain" in cmdline.lower():
                self.mark_ioc("cmdline", cmdline)
                self.severity += 1
        for indicator in self.files_re:
            for filepath in self.check_file(pattern=indicator, regex=True, all=True):
                self.mark_ioc("file", filepath)
                self.severity += 1
        for dll_re in self.dlls_re:
            for filepath in self.check_file(pattern=dll_re, regex=True, all=True):
                self.mark_ioc("file", filepath)
                self.severity += 1
            for dll in self.check_dll_loaded(pattern=dll_re, regex=True, all=True):
                self.mark_ioc("dll", dll)
                self.severity += 1

        if self.severity > 6:
            self.severity = 6
        return self.has_marks()
